In mid-September, security alarms in the crypto world were triggered almost simultaneously from two directions: one end being the application terminals in users' hands, and the other end being the vault system on the chain. According to a single source, on September 19, the Slow Mist security team and the OKX security team jointly issued a warning, confirming that versions 1.1-1.2 of the FomoPeek App contained unrelated modules that were confirmed to include malicious code capable of stealing users' private keys, recovery phrases, and assets; during this period, multiple users reported theft of assets after installing or using these two versions, with the time sequence highly overlapping with the version range, causing this seemingly ordinary data tool to instantly transform from a "market assistant" into a key thief lurking deep within the system. On the other end of the same timeline, according to a single source, the XLP vault of the decentralized exchange RISEx was attacked, and after the attacker took away large amounts of assets from the vault, they did not immediately disappear, prompting the project team to actively propose white hat negotiation conditions through on-chain messages: allowing the attacker to retain about 20% of the stolen funds, approximately 134,566 USDC, while the remaining approximately 80% (around 538,265 USDC or equivalent ETH) had to be returned to the official Ethereum or designated address by September 23, and it was observed that the stolen assets had begun to transfer between on-chain addresses. The current time still remains on September 19, and the return deadline set by RISEx has yet to arrive; whether the attacker will respond during this window period remains an unresolved suspense. These two incidents respectively tore open the defense lines of "key stealing" on the user side and "chain attacking" on the protocol side. Although there is currently no evidence from a single source indicating a direct correlation between them, their simultaneous emergence is enough to outline the real contours of the current crypto ecosystem's attack and defense situation, and also constitutes the narrative starting point for this article, which will unfold along two risk mainlines from terminals to the chain.
FomoPeek Kernel Attack Framework: Private Keys Under Silent Surveillance
Looking down along the defense line breach on the user side, the issue with FomoPeek is not an ordinary phishing scam that "looks like an official interface," but is closer to a system-level weapon disguised as an application. According to a single source, the Slow Mist security team and the OKX security team discovered in a joint investigation that versions 1.1-1.2 of FomoPeek contained a built-in iOS kernel vulnerability exploitation framework, which preset eight attack methods that could automatically select attack paths based on different device models and iOS system versions. More crucially, there exists an independent module within the application unrelated to normal business logic, which has been confirmed to contain malicious code. Its behavior pattern differs from the common practice of phishing pages that intercept input screenshots, leaning more towards directly exploiting the underlying system. This means that once a suitable device and system combination is hit, users' private keys and recovery phrases could be silently copied away through system-level channels without any awareness, according to a single source.
Thus, the risk is clearly locked within the version range of 1.1-1.2. According to a single source, the security team has recently received multiple reports of stolen assets from FomoPeek users, all of whom share a common characteristic—they had installed or used these two versions, and the investigation views this timeline as a key clue for tracing the malicious code. Unlike web phishing that can be avoided with visual recognition and link verification, this type of kernel attack framework expands the coverage of its attack surface by exploiting the mechanism of automatically selecting paths, while also weakening the users’ ability to self-defend through "cautious clicking," which explains why concentrated and similar theft cases have occurred. For this reason, the warning explicitly reminds users to avoid using versions related to FomoPeek to reduce the risk of private key and recovery phrase theft. For users who have already exposed their devices and private keys within this version range, the FomoPeek incident is no longer a theoretical risk but a reality of losses and ongoing security hazards that must be faced, according to a single source.
Mobile Crypto Tools Become Black Boxes: How Ordinary Users Recognize Anomalies
For most people, a crypto tool is just an icon, a simple interface, and a few lines of feature descriptions, while the actual reading and writing of keys and system calls are performed by invisible kernel-level modules. In versions 1.1-1.2 of FomoPeek, security teams identified that there were modules unrelated to normal business, which were confirmed to contain malicious code, according to a single source. This code does not change the operation process visible to the user, but directly reaches more underlying systems and key storage areas through kernel vulnerability exploitation frameworks. Victims often only "open the app as usual," and then enter a passive risk exposure process. According to a single source, many users recently encountered asset theft after installing or using this version range, and the chronological correlation is sufficient to become an investigative clue, yet the specific causation still needs further clarification on a technical level. This "everything seems normal on the surface, but the underlying layer is secretly loaded" supply chain security issue has turned mobile crypto tools into complete black boxes for users. Solely relying on whether the interface is smooth or the features are complete makes it difficult to assess whether there is an additional highly sensitive component unrelated to business inside.
In this opaque environment, what ordinary users can do is not audit the code, but rather raise their vigilance based on visible clues. Firstly, the source of the version itself is a signal: whether it comes from a clearly marked official channel, whether it remains within the named version range after security incidents have been exposed, these can all serve as starting points for user observation, according to a single source. Secondly, permission requests and behavior changes should be treated with sensitivity—when a tool starts frequently requesting system-level permissions, reading clipboards, or displaying abnormal pop-ups after an update, even if the interface and functions seem "richer," it should be seen as a risk alert rather than mere product iteration. Finally, subtle differences on the asset side are equally important: whether unknown address authorizations appear after key imports, or whether there are transaction records in the account that the user does not remember initiating, these are all external symptoms that might indicate internal manipulation of the black box. No single signal can constitute complete protection, but under the premise that malicious code can quietly embed itself into normal application modules, maintaining ongoing sensitivity to version sources, permission boundaries, and abnormal behaviors has become one of the few self-protection points for ordinary users in the black box world.
RISEx Vault Attacked: 20% White Hat Chips for 80% Recovery
Shifting from terminal black box risks to the on-chain vault, another storyline unfolded in mid-September: after the XLP vault of the decentralized exchange RISEx was attacked, the project team chose to negotiate directly on-chain with the attacker. According to a single source, RISEx made very clear conditions in the public message—the attacker could legally retain about 20% of the stolen funds, approximately 134,566 USDC, while the remaining approximately 80% (around 538,265 USDC or equivalent ETH) had to be returned to the official Ethereum or designated address by September 23. Meanwhile, the project team emphasized that they had observed the stolen assets starting to move on-chain, indicating that the attacker had not chosen to remain still but had been continuously adjusting their chip positions post-attack, leaving more room for subsequent choices under the time pressure that had already begun counting down.
This "20% chips for 80% recovery" white hat condition is essentially a public game: RISEx attempts to transform the attack from a purely confrontational situation into a transaction that can recover most of the funds by actively relinquishing part of their interests, but the real decision-making power remains firmly in the hands of those controlling the private keys. For the attacker, once they accept the conditions and return the funds to the designated address on-chain by September 23, they are compromising between risk and reward; if they continue to transfer assets and refuse to respond, the project team would only be able to follow up post-incident through legal and public opinion paths. As of the current date, September 19, a single source indicates that whether the attacker will respond within this limited window and return the funds as stipulated remains a key variable yet to be resolved.
Simultaneous Alarms on Both Attack and Defense Ends: User Entry and DeFi Vaults Both Exposed
On one end are individual users holding private keys and recovery phrases, and on the other end is the on-chain vault hosting protocol assets. They both nearly synchronously exposed security fissures in the same week. In the FomoPeek incident, the Slow Mist security team and the OKX security team jointly confirmed on September 19 that this App version 1.1-1.2 not only contains unrelated modules to normal business but also has a built-in attack framework exploiting iOS kernel vulnerabilities that can automatically match device models and system versions to steal private keys and recovery phrases (according to a single source). Previously, several users had reported asset theft after installing or using this range of versions, with the terminal entry directly attacked by malicious code, and the security team could only issue timely warnings to ordinary users, demanding a cutoff of the opportunity for such applications to access sensitive credentials from the source.
On the other end, RISEx represents a typical "back-end stop-loss" scenario: after the XLP vault was attacked, the on-chain assets fell under the control of the attack address, and the project team could only negotiate afterward through on-chain announcements, proposing conditions that "about 20% of the stolen funds, around 134,566 USDC, can be retained, while the remaining approximately 80% (around 538,265 USDC or equivalent ETH) must be returned to the designated address by September 23," while continuously observing the movement of the stolen funds on-chain (according to a single source). Similarly occurring in mid-September, one was the security team sounding the alarm before more users became victims, while the other was the project team attempting to limit loss boundaries afterward through negotiation and deadline stipulations. The juxtaposition of these two models—front-end defense and back-end stop-loss—reflects the long-term tug-of-war between security investment and risk exposure in the current crypto ecosystem. It is worth emphasizing that, up to now, there is no material indicating that the malicious code in FomoPeek has any correlation in technical pathways or personnel identity with the RISEx vault attack; attempts to splice the two into a unified conspiracy should be viewed as conjectures lacking sufficient evidence.
Starting from These Two Incidents: Security Signals to Monitor in the Coming Days
From the FomoPeek malicious App to the RISEx XLP vault being attacked, the first lesson you can observe is: whether it's the terminal device in hand or the on-chain vault written in contracts, there is no "inherently safe zone." According to a single source, versions 1.1-1.2 of FomoPeek have been confirmed by the security team to contain malicious code capable of stealing private keys, recovery phrases, and assets, and the affected version range has been clearly identified; according to a single source, RISEx has written the white hat negotiation conditions and the return deadline of September 23 into on-chain messages, allowing the attacker to retain approximately 134,566 USDC, while the remaining approximately 538,265 USDC or equivalent ETH must return to the designated address before the deadline. In the coming days, variables worth keeping an eye on include: whether the security team will disclose more technical details regarding FomoPeek's malicious modules, the progress of related version removals, fixes, and user-side inspections, as well as the on-chain dynamics of the stolen assets from RISEx within the white hat window—whether the funds continue to disperse or show signs of flowing back to the official address (according to a single source). Equally important is always distinguishing confirmed facts from portions yet to be validated when interpreting similar events: version ranges, white hat amounts, and deadlines have all been stated in public materials or on-chain, but details about the attacker's identity, invasion path, and even motives currently remain at the level of limited evidence. Attempts to simply string the two concurrently occurring attacks into a unified narrative or conspiracy should be regarded as conjectures lacking robust evidence; what truly deserves attention is how these security signals that have already been written into code and transaction records will evolve in the coming days.
Join our community, let's discuss and grow stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
